Logstash is not naming indices based on Filebeat tags

Elastic Stack Beats
1

Hi all experts!
I have the following configuration:

Beats:

filebeat.inputs:
 -type: log
  enabled: true
  tags: ["apache-error"]
  paths:
 - /var/log/httpd/error_log

 - type: log
   enabled: true
   tags: ["apache-access"]
   paths:
   - /var/log/httpd/access_log

... and logstash:

 if "apache-error" in [tags] {
            elasticsearch {
                    hosts => ["ES1"]
                    index => "apache-error-%{+YYYY.MM.dd}"
            }
 }

if "apache-access" in [tags] {
            elasticsearch {
                    hosts => ["ES2"]
                    index => "apache-access-%{+YYYY.MM.dd}"
            }
  }

However, indices are shown in ES like this:

filebeat-6.5.1-2018.12.07

Where am i messing up ?
Thanks in advance!

2

In your logstash output section, could you temporarily add this section so we can inspect the events being generated?

output {
   # ... existing plugins/if statements

  stdout {
    codec => rubydebug
  }
}

Then restart your Logstash node and look at the event objects being printed out to stdout. That might give you some clue as to why things aren't working as expected. If you can't figure it out, feel free to post a few events from stdout here (with any sensitive information redacted).

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.